OpenSSL command reference

The commands worth keeping within reach, grouped by what you are trying to do. Every block copies with one click.

Generate keys

openssl genrsa -out example.com.key 2048

RSA private key, 2048-bit — the safe default.

openssl ecparam -genkey -name prime256v1 | openssl pkcs8 -topk8 -nocrypt -out example.com.key

ECDSA P-256 key, written straight as PKCS#8 so every tool accepts it.

openssl rsa -in example.com.key -pubout -out example.com.pub

Extract the public half of an existing key.

openssl rsa -aes256 -in plain.key -out encrypted.key

Add a passphrase. Note: a server can't start unattended with one.

Create CSRs and self-signed certs

openssl req -new -key example.com.key -out example.com.csr

CSR from an existing key, prompting for each subject field.

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr -subj "/CN=example.com/O=My Company/C=TH" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Key and CSR in one non-interactive command, with the SAN list that actually matters.

openssl req -x509 -newkey rsa:2048 -nodes -days 365 -keyout dev.key -out dev.crt -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

Self-signed certificate for local development. Browsers will warn — that's expected.

openssl x509 -x509toreq -in cert.pem -signkey example.com.key -out renew.csr

Rebuild a CSR from a certificate you're renewing.

Inspect what you have

openssl x509 -in cert.pem -noout -text

Full human-readable dump of a certificate.

openssl x509 -in cert.pem -noout -subject -issuer -dates -serial

Just the fields you usually want.

openssl x509 -in cert.pem -noout -ext subjectAltName

The SAN list — the only hostnames the cert is valid for.

openssl x509 -in cert.pem -noout -fingerprint -sha256

SHA-256 fingerprint, for comparing two files quickly.

openssl req -in example.com.csr -noout -text -verify

Decode a CSR and check its self-signature.

openssl rsa -in example.com.key -noout -check

Validate that a private key file is intact.

openssl crl2pkcs7 -nocrl -certfile fullchain.pem | openssl pkcs7 -print_certs -noout

List every certificate inside a concatenated chain file.

Prove a key, cert and CSR belong together

openssl x509 -in cert.pem -noout -pubkey | openssl sha256

Public key hash from the certificate. Works for RSA and EC alike.

openssl pkey -in example.com.key -pubout | openssl sha256

Same hash, derived from the private key. Equal output means they match.

openssl req -in example.com.csr -noout -pubkey | openssl sha256

And from the CSR — all three should print the same digest.

openssl x509 -in cert.pem -noout -modulus | openssl md5

The classic RSA-only version of the same check.

Convert between formats

openssl x509 -in cert.pem -outform der -out cert.der

PEM → DER (binary).

openssl x509 -inform der -in cert.der -out cert.pem

DER → PEM (text).

openssl pkcs7 -print_certs -in chain.p7b -out chain.pem

PKCS#7 bundle → individual PEM certificates.

openssl pkcs12 -export -out bundle.pfx -inkey example.com.key -in cert.pem -certfile intermediate.crt

PEM → PKCS#12 (.pfx), the format Windows and Java want.

openssl pkcs12 -in bundle.pfx -nodes -out all.pem

PKCS#12 → PEM, key and certs unencrypted in one file.

openssl pkcs8 -topk8 -nocrypt -in old.key -out new.key

Legacy PKCS#1/SEC1 key → modern PKCS#8.

openssl rsa -in encrypted.key -out plain.key

Strip the passphrase off a key.

Test a live server

openssl s_client -connect example.com:443 -servername example.com </dev/null

Open a real TLS handshake and print what the server presents.

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null

Same, but dump every certificate in the chain it sends.

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

Expiry dates of the live certificate, nothing else.

openssl s_client -connect example.com:443 -servername example.com -tls1_2 </dev/null

Force a TLS version to check what's still enabled.

openssl verify -CAfile intermediate.crt cert.pem

Validate a chain locally against a given CA file.

openssl s_client -connect smtp.example.com:587 -starttls smtp

Certificates on a non-HTTPS service.